release: 1.1.0 -- the first behaviour change shipped under the freeze

Six live version surfaces bumped by hand (no sed -- provenance is never
bumped): pyproject.toml, __init__.__version__, README badge + Status + the
pinned pip install tag, docs/BRIEF.md, docs/ADOPTION-BRIEF.md Status, and
CLAUDE.md. ADOPTION-BRIEF's test count 792 -> 802.

NOT bumped, and deliberately: SECURITY.md's two `1.0.0` references name the
freeze BASELINE, not the current version -- "a payload that disposes WARN on
1.0.0 may dispose FAIL_SECURE on a later 1.x" is the promise this release
instantiates, so rewriting it to 1.1.0 would erase what it promised. The
GATE-G and PLAN-v1 numbers are the 1.0.0 gate record. The Forge repo
description carries no version (verified against the API last session).

This is the case SECURITY.md and the 1.0.0 CHANGELOG entry described in
advance: the exported surface is frozen, detection behaviour is not. No
exported name moved. A document that disposed WARN on 1.0.0 may dispose
FAIL_SECURE here; a consumer whose frontmatter carries an unquoted ": " in a
value will see those concepts refused at import, and quoting it parses.

Re-measured after the bump, alone: 802 passed, 129/129 classes, 6/6 gaps hold,
35 limitations.

CHANGELOG.md

@@ -10,6 +10,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Nothing yet.
 
 
+## [1.1.0] — 2026-08-13
+
+### Fixed — a mapping construct in OKF frontmatter no longer degrades into a string
+
+`okf.parse_frontmatter` gives the mapping *class* no expressible form by design
+(T2). Two routes escaped that: they parsed "successfully" into the wrong **type**
+instead of raising. Both are closed, and both now `FAIL_SECURE` through
+`okf.import_bundle` (door C).
+
+| route | was | now |
+|---|---|---|
+| `sources:`<br>`  - uri: https://e.com/a` | string `'uri: https://e.com/a'` — WARN | `OKFFrontmatterError` — FAIL_SECURE |
+| `sources:`<br>`  - uri:` | string `'uri:'` — WARN | `OKFFrontmatterError` — FAIL_SECURE |
+| `attester: resource: attesters/x.py` | string `'resource: attesters/x.py'` — WARN | `OKFFrontmatterError` — FAIL_SECURE |
+
+The security consequence was the same in each: a pointer parked in a degraded
+mapping rides through in a key the `resource` allowlist never inspects, and mode-b
+`import_bundle` writes the merged concept verbatim. The first route was documented
+at `docs/LIMITATIONS.md:43`; the inline second colon was **found by measurement
+while closing it**, and is the reason this release names two routes rather than one.
+Neither shape is conformant OKF — a well-formed bundle does not produce them; a
+malformed or hostile one can.
+
+**The boundary is where YAML puts it**, ground-truthed against PyYAML 6.0.3 rather
+than reasoned: `": "` and a trailing `":"` are exactly the two shapes where a plain
+scalar becomes a mapping, and they are refused. A colon carrying neither a space nor
+a line end opens no mapping — `domain:security` and `https://e.com:8443/a` still
+parse — and a quoted scalar (`- "uri: x"`) is still a scalar. Quotes are retained
+rather than stripped; that divergence from YAML is unchanged and now pinned.
+
+**This is a behaviour change inside the freeze, not a break of it.** No exported
+name moved. A document that disposed `WARN` on `1.0.0` may dispose `FAIL_SECURE`
+here — the `1.0.0` entry says exactly this is a fix, not a break. A consumer whose
+bundles carry an unquoted `": "` in a frontmatter value will now see those concepts
+refused at import; quote the value, and it parses.
+
+Suite 792 → **802** (11 rows added, 1 retired). 129/129 classes, 6/6 documented
+gaps, 35 limitations — all unchanged.
+
+
 ## [1.0.0] — 2026-08-13
 
 ### Changed — the exported Python surface is frozen under semver

CLAUDE.md

@@ -11,7 +11,7 @@ framework-agnostisk kode.
 Referanse-implementasjon: `claude-code-llm-wiki` Stage B (`tools/wiki_ingest/`).
 Lexikon-seed: `injection-patterns.mjs` fra `llm-security`-pluginen.
 
-Repoet er på **v1.0.0** — den eksporterte Python-surfacen er frosset under semver
+Repoet er på **v1.1.0** — den eksporterte Python-surfacen er frosset under semver
 (deteksjonsatferd er det IKKE; kalibrering flytter seg i 1.x). Stdlib-kjernen er
 bygget og testet (15 moduler +
 topp-nivå wiring, showcase + korpus), inkl. OKF-adapter og aktivt-innhold-

README.md

@@ -2,7 +2,7 @@
 
 Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure.
 
-![Version](https://img.shields.io/badge/version-1.0.0-blue)
+![Version](https://img.shields.io/badge/version-1.1.0-blue)
 ![Status](https://img.shields.io/badge/status-stable-brightgreen)
 ![Python](https://img.shields.io/badge/python-3.10%2B-purple)
 ![License](https://img.shields.io/badge/license-MIT-lightgrey)
@@ -33,7 +33,7 @@ at write time, never assumed from the format. Any pipeline ingesting external da
 into an agent-read store has this shape; an OKF wiki is its canonical form — which
 is why the guard ships a first-class OKF adapter (below).
 
-**Status:** `v1.0.0`. The stdlib-only core — its detector, contract, and
+**Status:** `v1.1.0`. The stdlib-only core — its detector, contract, and
 OKF-adapter modules plus the top-level wiring — is built and tested, exercised by
 an end-to-end showcase and adversarial + false-positive corpora. The exported
 Python surface is now frozen under semver: nothing exported is removed, renamed or
@@ -46,7 +46,7 @@ are real limitations, stated plainly below; read them.
 Not on PyPI. The guard is distributed from its Forgejo origin — pin a release tag:
 
 ```bash
-pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.0.0"
+pip install "llm-ingestion-guard @ git+https://git.fromaitochitta.com/open/llm-ingestion-pipeline-security.git@v1.1.0"
 ```
 
 The `open/` mirror is anonymously readable, so CI needs no deploy key, token, or

docs/ADOPTION-BRIEF.md

@@ -4,7 +4,7 @@
 especially one converging on Google's Open Knowledge Format (OKF v0.1) — and needs
 to decide **when** and **where** to add a write-time ingestion guard.
 
-**Status of the guard:** `v1.0.0`. Stdlib-only core, framework-agnostic. The
+**Status of the guard:** `v1.1.0`. Stdlib-only core, framework-agnostic. The
 exported Python surface is frozen under semver — nothing exported is removed,
 renamed or given a different meaning without a `2.0.0`. Detection behaviour is
 *not* frozen: severities, thresholds and lexicon entries are calibration and move
@@ -142,9 +142,9 @@ live payload:
 python -m llm_ingestion_guard.coverage    # exit 0 = all as documented
 ```
 
-As of `v1.0.0`: **129 / 129 defended classes demonstrated (recall 100%)** and **6 /
+As of `v1.1.0`: **129 / 129 defended classes demonstrated (recall 100%)** and **6 /
 6 documented gaps still hold** (a *closed* gap fails the test, forcing a doc
-update). The matrix is the single source of truth for the test suite (**792
+update). The matrix is the single source of truth for the test suite (**802
 passing**), which also asserts total recall, that every lexicon pattern has a
 case (so the matrix cannot fall behind the lexicon), the full LLM02 secret-egress
 set, and the container-layer front-end (CSV formula-injection, zip-slip/bomb,

docs/BRIEF.md

@@ -3,7 +3,7 @@
 **A reusable, minimal, dependency-light defensive layer for LLM *ingestion*
 pipelines — the write-time siblings of query-time chatbot guardrails.**
 
-Status: implemented — v1.0.0, exported surface frozen under semver. This document defines what the repo contains
+Status: implemented — v1.1.0, exported surface frozen under semver. This document defines what the repo contains
 and why; the stdlib-only core is built and tested (see `README.md` for usage and
 `docs/PLAN.md` for the build order).
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "llm-ingestion-guard"
-version = "1.0.0"
+version = "1.1.0"
 description = "Write-time defensive layer for Python pipelines that persist LLM output: sanitize, fence, tool-less quarantined transform, capability isolation, scan before persist, fail-secure."
 readme = "README.md"
 requires-python = ">=3.10"

src/llm_ingestion_guard/__init__.py

@@ -63,7 +63,7 @@ from .grounding import (
 )
 from . import okf
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"
 
 
 # --- §6 bookends: the two library-side halves around the transform ---------